


How to detect and kill Trojans in Linux system
[导读] 木马和后门的查杀是系统管理员一项长期需要坚持的工作,切不可掉以轻心。以下从几个方面在说明Linux系统环境安排配置防范和木马后门查杀的方法:一、Web Server(以Nginx为例)1、为防止跨站感染,将虚拟主机目
木马和后门的查杀是系统管理员一项长期需要坚持的工作,切不可掉以轻心。以下从几个方面在说明Linux系统环境安排配置防范和木马后门查杀的方法:
一、Web Server(以Nginx为例)
1、为防止跨站感染,将虚拟主机目录隔离(可以直接利用fpm建立多个程序池达到隔离效果)
2、上传目录、include类的库文件目录要禁止代码执行(Nginx正则过滤)
3、path_info漏洞修正:
在nginx配置文件中增加:
if ($request_filename ~* (.*).php) {set $php_url $1; }if (!-e $php_url.php) {return 404; }
4、重新编译Web Server,隐藏Server信息
5、打开相关级别的日志,追踪可疑请求,请求者IP等相关信息。
二.改变目录和文件属性,禁止写入
find -type f -name *.php -exec chmod 444 {} ;find -type d -exec chmod 555 {} ;
注:当然要排除上传目录、缓存目录等;
同时最好禁止chmod函数,攻击者可通过chmod来修改文件只读属性再修改文件!
三.PHP配置
修改php.ini配置文件,禁用危险函数:
disable_funcions = dl,eval,exec,passthru,system,popen,shell_exec,proc_open,proc_terminate,curl_exec,curl_multi_exec,show_source,touch,escapeshellcmd,escapeshellarg
四.MySQL数据库账号安全:
禁止mysql用户外部链接,程序不要使用root账号,最好单独建立一个有限权限的账号专门用于Web程序。
五.查杀木马、后门
grep -r –include=*.php ‘[^a-z]eval($_POST’ . > grep.txtgrep -r –include=*.php ‘file_put_contents(.*$_POST[.*]);’ . > grep.txt
把搜索结果写入文件,下载下来慢慢分析,其他特征木马、后门类似。有必要的话可对全站所有文件来一次特征查找,上传图片肯定有也捆绑的,来次大清洗。
查找近2天被修改过的文件:
find -mtime -2 -type f -name *.php
注意:攻击者可能会通过touch函数来修改文件时间属性来避过这种查找,所以touch必须禁止
六.及时给Linux系统和Web程序打补丁,堵上漏洞
The above is the detailed content of How to detect and kill Trojans in Linux system. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics



The main reasons why you cannot log in to MySQL as root are permission problems, configuration file errors, password inconsistent, socket file problems, or firewall interception. The solution includes: check whether the bind-address parameter in the configuration file is configured correctly. Check whether the root user permissions have been modified or deleted and reset. Verify that the password is accurate, including case and special characters. Check socket file permission settings and paths. Check that the firewall blocks connections to the MySQL server.

C language conditional compilation is a mechanism for selectively compiling code blocks based on compile-time conditions. The introductory methods include: using #if and #else directives to select code blocks based on conditions. Commonly used conditional expressions include STDC, _WIN32 and linux. Practical case: Print different messages according to the operating system. Use different data types according to the number of digits of the system. Different header files are supported according to the compiler. Conditional compilation enhances the portability and flexibility of the code, making it adaptable to compiler, operating system, and CPU architecture changes.

1.0.1 Preface This project (including code and comments) was recorded during my self-taught Rust. There may be inaccurate or unclear statements, please apologize. If you benefit from it, it's even better. 1.0.2 Why is RustRust reliable and efficient? Rust can replace C and C, with similar performance but higher security, and does not require frequent recompilation to check for errors like C and C. The main advantages include: memory security (preventing null pointers from dereferences, dangling pointers, and data contention). Thread-safe (make sure multi-threaded code is safe before execution). Avoid undefined behavior (e.g., array out of bounds, uninitialized variables, or access to freed memory). Rust provides modern language features such as generics

The five basic components of Linux are: 1. The kernel, managing hardware resources; 2. The system library, providing functions and services; 3. Shell, the interface for users to interact with the system; 4. The file system, storing and organizing data; 5. Applications, using system resources to implement functions.

There are many reasons why MySQL startup fails, and it can be diagnosed by checking the error log. Common causes include port conflicts (check port occupancy and modify configuration), permission issues (check service running user permissions), configuration file errors (check parameter settings), data directory corruption (restore data or rebuild table space), InnoDB table space issues (check ibdata1 files), plug-in loading failure (check error log). When solving problems, you should analyze them based on the error log, find the root cause of the problem, and develop the habit of backing up data regularly to prevent and solve problems.

The C language function library is a toolbox containing various functions, which are organized in different library files. Adding a library requires specifying it through the compiler's command line options, for example, the GCC compiler uses the -l option followed by the abbreviation of the library name. If the library file is not under the default search path, you need to use the -L option to specify the library file path. Library can be divided into static libraries and dynamic libraries. Static libraries are directly linked to the program at compile time, while dynamic libraries are loaded at runtime.

MySQL cannot run directly on Android, but it can be implemented indirectly by using the following methods: using the lightweight database SQLite, which is built on the Android system, does not require a separate server, and has a small resource usage, which is very suitable for mobile device applications. Remotely connect to the MySQL server and connect to the MySQL database on the remote server through the network for data reading and writing, but there are disadvantages such as strong network dependencies, security issues and server costs.

The solution to MySQL installation error is: 1. Carefully check the system environment to ensure that the MySQL dependency library requirements are met. Different operating systems and version requirements are different; 2. Carefully read the error message and take corresponding measures according to prompts (such as missing library files or insufficient permissions), such as installing dependencies or using sudo commands; 3. If necessary, try to install the source code and carefully check the compilation log, but this requires a certain amount of Linux knowledge and experience. The key to ultimately solving the problem is to carefully check the system environment and error information, and refer to the official documents.
